Skip to content

v0.6.0 Phase 4 Broaden (SPL dialect)

Choose a tag to compare

View all tags
@chriswayneh chriswayneh released this 24 Sep 12:19
· 4 commits to main since this release
v0.6.0
43b8966

Phase 4 Broaden — optional SPL field extraction

Sigma remains the default. This release adds a pluggable, offline SPL dialect for simple field references — not a query engine or matcher. Continues Phase 4 after KQL in v0.5.0.

What's new

  • --dialect sigma|kql|spl|auto on detdrift diff and detdrift fields
  • Simple SPL extraction: Field=, stats … by, table, rex field=
  • Sample: examples/spl/rules + fixtures/spl
  • Docs: README, ROADMAP, ARCHITECTURE, skill updated

Not in this release

  • PyPI publish (needs secrets)
  • Full SPL/eval/subsearch support

Verify

pip install -e .[dev]
pytest -q
detdrift fields examples/spl/rules/whoami_process.spl
detdrift diff -b fixtures/spl/before -a fixtures/spl/after -r examples/spl/rules --dialect spl
Assets 2
Loading